NFMart

All of the initial distributed `NFM` tokens are sent to the contract deployer or one or several externally-owned account (EOA) addresses. This is a centralization risk because the deployer or the owner(s) of the EOAs can distribute tokens without obtaining the consensus of the community. Any compromise to these addresses may allow a hacker to steal and sell tokens on the market, resulting in severe damage to the project.

The `burnFrom` function contains a balance check that erroneously checks the unlocked balance of `msg.sender` instead of the `from` address. When `msg.sender` attempts to burn tokens from `from` address, the function incorrectly checks the unlocked balance of `msg.sender`, potentially allowing burns when the `from` address has insufficient unlocked balance or allowance. Original Code Snippet: ```solidity function burnFrom(address from, uint256 value) public notFrozen(from) { if (timelockList[from].length > 0) { _autoUnlock(from); } require(SafeMath.sub(balanceOf(msg.sender), lockedBalanceOf(msg.sender)) >= value, "not enough balance."); _burnFrom(from, value); } ```